Origin validation error in Schweitzer Engineering Laboratories SEL-5037 Grid Configurator
Priority LOW 32CWE-346Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.
Summary
SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This gateway service includes an API which is not properly configured to reject requests from unexpected sources.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00173 6th percentileScored 2026-11-07
Fix Fixed SEL-5037 Grid Configurator (Schweitzer Engineering Laboratories): 6.4.0.58
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schweitzer Engineering Laboratories | SEL-5037 Grid Configurator | before 6.4.0.58 | 6.4.0.58 | Patch available | CNA |
- SEL-5037 Grid Configurator VendorSchweitzer Engineering Laboratories Affected before 6.4.0.58 Fixed in 6.4.0.58 Patch available CNA
Remediation
- Fix · CNA SEL-5037 Grid Configurator (Schweitzer Engineering Laboratories) Fixed in 6.4.0.58
Timeline
- 2026-10-02 Threatist record created from CVE-2025-46737
- 2026-10-03 Alias added: GHSA-2jfq-w82p-5wx6
References
More Schweitzer Engineering Laboratories vulnerabilities
- TI-2023-14886 Insufficient entropy vulnerability could lead to authentication bypass CVSS 3.1CRITICAL 9.8
- TI-2018-07489 XML external entity injection in Schweitzer Engineering Laboratories AcSELerator Architect CVSS 3.0CRITICAL 9.8
- TI-2017-05537 Improper access control in Schweitzer Engineering Laboratories, Inc. SEL-3620 and SEL-3622 CVSS 3.0CRITICAL 10.0
- TI-2023-17218 Improper authentication could lead to session hijacking CVSS 3.1CRITICAL 9.8
- TI-2023-14885 Execution with Unnecessary Privileges CVSS 3.1CRITICAL 9.8
- TI-2023-14859 Improper Input Validation in Web Interface CVSS 3.1CRITICAL 9.1
Sources
- CVE-2025-46737 · CVE Program
- CVE-2025-46737 · NVD
- FIRST EPSS
- GHSA-2jfq-w82p-5wx6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences